loading
Loading content
loading
Utilities
Extract all hosted zones from AWS Route53.
overview
aws-route53-zones pulls hosted zone inventory from AWS Route53 so cloud DNS that never appears in public CT logs still enters your asset map.
It is an authenticated cloud enumeration step: the node needs AWS credentials with permission to list zones, then writes the zone set for downstream DNS or subdomain work.
Run it in cloud recon when the target uses Route53 and you need internal or public zones that passive DNS alone will miss.
source github.com/trickest
use cases
Pull every Route53 hosted zone to start an attack-surface workflow from the domains the account actually owns instead of a guessed list.
Extract all zones to build a current inventory of managed domains for an asset register or a scoping document.
Hand the zone list to subfinder or assetfinder so discovery runs across the full set of owned domains in one pass.
List the zones still configured in Route53 to spot domains that are no longer in active use but remain resolvable and exposed.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| aws-credentials | FILE | · | AWS credentials contaning a User with privileges to list AWS Route53 hosted zones. |
Showing key inputs. aws-route53-zones exposes 1 inputs in total.
example
# aws-route53-zones: list hosted zones in the configured accountaws-route53-zonesexample.com. ZAAAAAAAAAAAAA publicapi.example.com. ZBBBBBBBBBBBBB publicinternal.example.com. ZCCCCCCCCCCCCC privatestaging.example.com. ZDDDDDDDDDDDDD publicdev.example.com. ZEEEEEEEEEEEEE publicguidance
Use aws-route53-zones when you have authorized access to an AWS account and want the real list of domains it owns. It reads cloud DNS config, it does not enumerate subdomains, so feed its zones into subfinder or a resolver next.
Lists assets across multiple cloud providers including DNS. Broader scope, aws-route53-zones is the focused Route53 read.
Hunts for exposed cloud resources without credentials. Different angle, unauthenticated discovery rather than account read.
Passive subdomain discovery. Run it after the zones are listed to enumerate names under each domain.
faq
related
Import, export, and link workflow data with Airtable.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Output file lines by batch size, given START_LINE and END_LINE.
Extract a batch range from a file's lines or a folder's files, with parallel processing.
Organize all the community Nuclei templates from across the ecosystem in one place.
AWS credentials feed aws-route53-zones, which lists the account's hosted zones and passes them to subfinder, writing the discovered subdomains as output.
Facts on this page come from the live Trickest tool library.